Privacy Policy

Last updated: 2026-10-14

1. General Provisions

This Policy explains how mitla.shop (“Service”) processes users' personal data. The Service is an online platform for posting listings and facilitating interactions between users, and does not accept payments, does not store payment details, does not perform escrow, and is not a party to sales transactions.

2. Data Controller and Contacts

Data Controller: Administration of mitla.shop.
Contact for inquiries: s•••@•••.
A postal address or an authorized representative may be indicated if necessary.

3. Categories of Data

  • Account data: name/nickname, email, phone (if provided), account ID.
  • Operational data: history of listings/orders, support inquiries, technical event logs.
  • Sign-in log: the time of each sign-in, the method (password or Google), IP address, browser and device (user-agent), the sign-out time.
  • Last activity: only the time you were last active on the site or in the seller cabinet (for the "online" status); what you did is not recorded.
  • Visit statistics: see section 5. The Service does not store payment card data and does not process payments.

4. Purposes and Legal Grounds for Processing

  • Providing the service functionality: account creation and maintenance, posting listings, processing user actions (performance of a contract).
  • Security and abuse prevention: the sign-in log, monitoring, incident diagnostics, infrastructure protection (legitimate interest).
  • Statistics without identifiers: understanding which pages and products help buyers (legitimate interest; the data is not linked to a person).
  • Analytics and ad measurement: only with your consent in the cookie banner, which you can withdraw at any time.
  • Communications: service notifications, support responses (performance of a contract/legitimate interest). Marketing messages - only with separate consent, which can be withdrawn.

5. Cookies, Statistics and Analytics

Without your consent the server counts only anonymous statistics: pages and products viewed, search terms (terms that look like a phone number or an email are dropped), the domain of the site you came from, UTM tags, the device type and the browser family. Your IP address is not used for statistics, nothing is stored in your browser and there is no identifier. With analytics consent a random browser identifier (mitla.vid) and Google Analytics are added; with advertising consent, Google Ads conversion measurement. The list of cookies and browser storage entries, their lifetimes and consent settings are in the Cookie Policy.

6. Data Sharing with Third Parties

Data may be processed by infrastructure providers (hosting, email, monitoring) or disclosed to competent authorities if required by law. With your consent, visit data is received by Google (Google Analytics, Google Ads, quick sign-in with Google) under Google's own terms. We do not sell personal data and do not share it for marketing purposes without your consent.

7. International Transfers

If data processors are located outside Ukraine/EEA, appropriate transfer safeguards are applied (contractual clauses, technical and organizational measures).

8. Data Retention

Account data is retained while the account is active or as long as needed for processing purposes. The IP address and browser in the sign-in log are kept for 90 days, the sign-in records for 12 months. Visit statistics are kept for 13 months. Technical logs are kept for a limited time. Data may be stored longer if required by law.

9. Security

We apply HTTPS, access control, auditing, and backups. No method can guarantee absolute security, but we continually improve protection.

10. Data Subject Rights

You have the right to access, rectify, erase, restrict processing, object to processing, data portability (if applicable), and withdraw consent. Send requests to s•••@•••. We respond within 30 days, with a possible 30-day extension for complex cases.

11. Age Restrictions

The Service is intended for users aged 18 and over. If you are under 18, you may not register or use the Service.

12. Changes to the Policy

We may update this Policy. The current version is available on this page with the update date. In case of significant changes, we may send notifications to users.

Data protection contact: s•••@•••